PT-2025-27214 · Acmeedesign · Wpshapere Lite

Name of the Vulnerable Software and Affected Versions: AcmeeDesign WPShapere Lite versions 1.4 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. Recommendations: For AcmeeDesign WPShapere Lite versions 1.4 and earlier, update to a versio...

CVE-2025-50370

CVE-2025-50370 affects Phpgurukul Medical Card Generation System 1.0, specifically the Inquiry Management endpoint /mcgs/admin/readenq.php. A CSRF flaw exists where an authenticated admin can delete inquiry records via a simple GET request without CSRF token or origin validation. This is supporte...

PT-2025-27210 · Onionbuzz · Onionbuzz

Name of the Vulnerable Software and Affected Versions: OnionBuzz versions n/a through 1.0.7 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS in Looks Awesome OnionBuzz. Recommendations: For OnionBuzz versions n/a through 1.0.7, update to a version...

PT-2025-27238 · Unknown · Phpgurukul Medical Card Generation System

Name of the Vulnerable Software and Affected Versions: Phpgurukul Medical Card Generation System version 1.0 Description: A Cross-Site Request Forgery CSRF issue exists in the Inquiry Management functionality, specifically at the "/mcgs/admin/readenq.php" endpoint. This allows an authenticated...

WordPress WP GDPR Cookie Consent Plugin <= 1.0.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP GDPR Cookie Consent Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2025-53316 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID aa421b31b5f1 Credits Skalucy Requir...

PT-2025-27181 · WordPress · Hossin Asaadi Wp Permalink Translator

Name of the Vulnerable Software and Affected Versions: Hossin Asaadi WP Permalink Translator versions 1.7.6 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a...

PT-2025-27211 · Unknown · Plumwd Twitch Tv Embed Suite

Name of the Vulnerable Software and Affected Versions: plumwd Twitch TV Embed Suite versions n/a through 2.1.0 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS in the plumwd Twitch TV Embed Suite. Recommendations: For versions n/a through 2.1.0,...

PT-2025-27223 · Unknown · Samcharrington Rss Digest

Name of the Vulnerable Software and Affected Versions: samcharrington RSS Digest versions n/a through 1.5 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on the web...

PT-2025-27176 · Unknown · My Wp Brand

Name of the Vulnerable Software and Affected Versions: My Wp Brand versions 1.1.3 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. Recommendations: For versions 1.1.3 and earlier, update to a version that contains a fi...

PT-2025-27212 · WordPress · Sh1Zen Wp Optimizer

Name of the Vulnerable Software and Affected Versions: sh1zen WP Optimizer versions 2.3.6 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows SQL Injection. Recommendations: For sh1zen WP Optimizer versions 2.3.6 and earlier, update to a version later...

CVE-2025-48921 Open Social - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-079

Cross-Site Request Forgery CSRF vulnerability in Drupal Open Social allows Cross Site Request Forgery.This issue affects Open Social: from 0.0.0 before 12.3.14, from 12.4.0 before 12.4.13...

CVE-2025-50179 Tuleap missing CSRF protection on tracker reports manipulation

Tuleap is an Open Source Suite to improve management of software developments and collaboration. An attacker could use a cross-site request forgery vulnerability in Tuleap Community Edition prior to version 16.8.99.1749830289 and Tuleap Enterprise Edition prior to version 16.9-1 to trick victims...

CVE-2025-50179

Summary: CVE-2025-50179 affects Tuleap. The vulnerability is a cross-site request forgery (CSRF) that could allow an attacker to trick victims into changing canned responses. Affected products are Tuleap Community Edition prior to 16.8.99.1749830289 and Tuleap Enterprise Edition prior to 16.9-1. ...

CVE-2025-48991

CVE-2025-48991 describes a cross-site request forgery vulnerability in Tuleap that could allow an attacker to trick victims into changing canned tracker responses. Affected versions: Tuleap Community Edition prior to 16.8.99.1748845907; Tuleap Enterprise Edition prior to 16.8-3 and prior to 16.7-...

CVE-2025-48991 Tuleap missing CSRF protection on tracker canned responses administration

Tuleap is an Open Source Suite to improve management of software developments and collaboration. An attacker could use a vulnerability present in Tuleap Community Edition prior to version 16.8.99.1748845907 and Tuleap Enterprise Edition prior to versions 16.8-3 and 16.7-5 to trick victims into...

CVE-2025-48991 Tuleap missing CSRF protection on tracker canned responses administration

Tuleap is an Open Source Suite to improve management of software developments and collaboration. An attacker could use a vulnerability present in Tuleap Community Edition prior to version 16.8.99.1748845907 and Tuleap Enterprise Edition prior to versions 16.8-3 and 16.7-5 to trick victims into...

ROS-20250625-03

Vulnerability of eachpair function from strongparameters.rb of Ruby on Rails software platform is related to recovery of an invalid data structure in memory. Exploitation of the vulnerability could allow a remote attacker to gain access to confidential data Vulnerability in Ruby on Rails software...

ROS-20250625-04

A vulnerability in the Ruby on Rails software platform is related to a CSRF vulnerability in the rails-ujs module. Exploitation of the vulnerability could allow an attacker acting remotely to send CSRF tokens to the wrong domains. invalid domains...

SUSE CVE-2025-52968

xdg-open in xdg-utils through 1.2.1 can send requests containing SameSite=Strict cookies, which can facilitate CSRF. For example, xdg-open could be modified to, by default, associate x-scheme-handler/https with the execution of a browser with command-line options that arrange for an empty cookie...

Moodle 5.0.x < 5.0.1 Multiple Vulnerabilities

According to its self-reported version, the Moodle install hosted on the remote host is 4.1.x prior to 4.1.19, or 4.4.x prior to 4.4.9, or 4.5.x prior to 4.5.5, or 5.x prior to 5.0.1. It is, therefore, affected by multiple vulnerabilities : - A stricter capability check was required to restrict...